PDF malware analysis — malicious · 9db3aab29cb24274

MALICIOUS

PDF

15.1 KB Created: 2009-11-15 19:41:70 Authoring application: PDF Library 4.3.9 (via PDF Library 3.9.7)

MD5: e52f47aef70d8b0ee21ec16260bee89e SHA-1: 8c013fc1919136de541cdf6df1b14085595888d9 SHA-256: 9db3aab29cb24274a90a30247d0a8cc0656e70c039ecaefd0cabb75dc191218f

166 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The file is a PDF containing embedded JavaScript, flagged by multiple heuristics and a machine learning classifier as malicious. ClamAV identifies it as Win.Trojan.Agent-36166. The embedded JavaScript is the primary indicator of malicious intent, likely serving as a downloader for further malicious activity. Due to the lack of specific script content and document body text, the exact payload and delivery mechanism cannot be definitively determined.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 4

ClamAV: Win.Trojan.Agent-36166 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Win.Trojan.Agent-36166
ClamAV detection on extracted artifact critical EXTRACTED_FILE_CLAMAV

ClamAV flagged at least one file extracted from inside this sample. Even when the wrapping document carries no AV detection of its own, a hit on the carved artifact is a strong indicator the sample is a delivery vehicle.
JavaScript action low PDF_JAVASCRIPT

PDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`javascript_obj0007_000.js` `7e8557127a504d512c7c374b23e45944c36ec8d88c02ea299d508f3db8555215`	pdf-javascript-stream	PDF /JS object 7 at offset 0x1A5	84246 bytes
Detection ClamAV: Win.Trojan.Agent-36166 Obfuscation or payload: unlikely

Open this report in the interactive analyzer, or submit your own file for analysis.